Time series search engine

An apparatus for a time series search engine for time searching data, comprising:

• a memory for storing data and instructions;
• a processor for executing instructions that perform actions, including:
• receiving time series data streams from an information processing environment that includes a plurality of servers;
• organizing the time series data stream for subsequent searching by performing actions, including:
• determining at least one domain that corresponds to data in the time series data streams, wherein data in the time series data streams is aggregated based on at least the one determined domain;
• time stamping the time series data streams to create at least one time stamped event that includes at least a portion of aggregated data from the time series data streams, wherein the time stamped event represents a statistic and a pattern of behavior;
• employing at least one feature of the included aggregated data to determine at least one boundary for each time stamped event;
• segmenting each time stamped event into a plurality of segments, wherein a segment is a substring of event text;
• time indexing the time stamped events to create time bucketed indices based on the time stamps and segments;
• and
• receiving a time series search request;
• and
• executing the time series search request at least in part by searching the time bucketed indices.

A computer program product for time searching data, the computer program product stored on a non-transitory computer readable storage medium and including instructions for causing a computer system to execute a method for time searching data, the method comprising the actions of:

• receiving time series data streams from an information processing environment that includes a plurality of servers;
• organizing the time series data stream for subsequent searching by performing actions, including:
• determining at least one domain that corresponds to data in the time series data streams, wherein data in the time series data streams is aggregated based on at least the one determined domain;
• time stamping the time series data streams to create at least one time stamped event that includes at least a portion of aggregated data from the time series data streams, wherein the time stamped event represents a statistic and a pattern of behavior;
• employing at least one feature of the included aggregated data to determine at least one boundary for each time stamped event;
• segmenting each time stamped event into a plurality of segments, wherein a segment is a substring of event text;
• time indexing the time stamped events to create time bucketed indices based on the time stamps and segments;
• and
• receiving a time series search request;
• and
• executing the time series search request at least in part by searching the time bucketed indices.